CVE-2026-40805: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in PeepSo = 9.0.5.4 versions...

CVE-2026-108597: Improper Limitation of a Pathname to a Restricted Directory

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-91136: Improper Limitation of a Pathname to a Restricted Directory

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

CVE-2026-104722: Improper Limitation of a Pathname to a Restricted Directory

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSDMenusIXCSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticate...

CVE-2026-102291: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's displayname into the composed page markup unfiltered and then running the...

CVE-2026-62052: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Tipsy = 1.6 versions...

CVE-2026-62025: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in Tailored Tools = 3.0.3 versions...

CVE-2026-62053: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Wine House = 3.20 versions...

CVE-2026-62024: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in CodeBard Help Desk = 1.1.2 versions...

CVE-2026-89100: Improper Neutralization of Input During Web Page Generation

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-104801: Improper Limitation of a Pathname to a Restricted Directory

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the renamefiles function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete...

CVE-2026-83526: Unrestricted Upload of File with Dangerous Type

The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the checkmimetype function. This is due to insufficient file type validation in checkmimetype, which writes attacker-supplied remote file content to the public uploads...

CVE-2026-17025: Improper Neutralization of Input During Web Page Generation

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-109477

Name of the Vulnerable Software and Affected Versions Extensions For CF7 versions prior to 3.4.6 Description An arbitrary file upload flaw exists in the extcf7 submit function. The issue stems from missing file extension, MIME type, and size validation within the validation filter of the signatur...

PT-2026-109616

Name of the Vulnerable Software and Affected Versions Divi Plus versions prior to 2.4.1 Description The Divi Plus plugin for WordPress allows unauthenticated attackers to read arbitrary files on the server. This occurs because the permission callback function SVGAnimatorController::index permissi...

PT-2026-109760

Name of the Vulnerable Software and Affected Versions PeepSo versions prior to 9.0.5.5 Description A flaw allows a user with Subscriber privileges to perform arbitrary file deletion on the system. Recommendations Update to version 9.0.5.5 or later...

PT-2026-109858

Subscriber Arbitrary File Deletion in FoodBakery = 4.6 versions...

PT-2026-109738

Name of the Vulnerable Software and Affected Versions Cohere Python SDK versions 5.11.0 through 7.2.0 Description A path traversal tar slip issue exists in the s3 models dir to tarfile function. This occurs due to unvalidated tarfile.extractall calls, which allow arbitrary file writes. An attacke...

RockyLinux 10 : dovecot (RLSA-2026:79371)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:79371 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorrect...

PT-2026-109552

Name of the Vulnerable Software and Affected Versions PPOM – Product Addons & Custom Fields for WooCommerce versions prior to 34.0.11 Description Insufficient file path validation in the rename files function allows unauthenticated attackers to delete arbitrary files on the server. This action ca...